This repository is a research model. It holds no keys, makes no network calls and moves no funds, so there is no deployed system to attack. Review of the model is still valuable, because a wrong rule here may point at a wrong rule in the spec.

• A transition the model allows that could let one party end up with both sides of a swap, or lose funds with no recourse.
• A deadline rule that disagrees with the spec in a way that matters.
• A timelock constraint that is wrong or missing.
• Anything in the docs that could mislead a reader into treating this code as a usable swap.

Please report privately. Open a private security advisory on this repository using the "Report a vulnerability" option under the Security tab. Do not open a public issue or pull request for a vulnerability.

Include, as far as you can:

• A description of the problem and the affected file or rule.
• A scenario or event sequence that shows it.
• The impact you expect.
• Any suggested fix.

• We will acknowledge the report in the advisory thread.
• We will work with you to confirm the issue.
• We will fix the model, and the spec if needed, and credit you if you wish.

Good-faith research and responsible disclosure under this policy will not be met with legal action.

There is no bounty program at this stage.